Revoke Token

Soft-revoke one of the caller's own personal access tokens (idempotent).

Scoped to the caller's own keys (subject_id), mirroring list_tokens — you cannot revoke another user's PAT even within your conglomerate (matters once a conglomerate has multiple users). Follows the ownership canon: a genuinely-missing token is 404, a token owned by someone else is 403 (foreign-but-existing), never masked as 404. Only PATs are revocable here; the login session (cli_session) is revoked via logout.